Subject: RE: Role of Regional Agent in AAA (was: Re: [mobile-ip] LMM requirements: security issue)

From: [email-masked]
Date: Mon, 9 Sep 2002 09:26:00 +0300

Hi Mike,

>    Why is this "ideal"? The entire point of the IP
>    architecture is to not require all-in-one
>    vertical applications/protocols... like
>    ISUP. There are lot of ways to go about solving
>    these problems; we shouldn't be prejudiced one
>    way or the other. 
> 
>    The key here is to have the unifying elements
>    of authentication built into the various
>    protocols which require auth/authz. This
>    include mundane stuff like straight password
>    based protocols (CHAP, say), to Kerberos, PKI 
>    and my personal fav Kerberos+PKI. Once those
>    elements are built into the various protocols,
>    it will be a lot easier to decide how to
>    actually architect a network. The current
>    situation with traditional AAA has some serious
>    tail-wagging-dog syndrome, as in its proceeding
>    from the premise "since this is all we have..."
>    It's also suspiciously bellheaded -- like a
>    HLR combover.

I have to agree with you on this.  I would phrase this
in another way however.  I wouldn't want to architect
the kind of solution which James is proposing here in
the architect.  I'd prefer to allow the basic protocols
which require authentication / authorization to support
the basic protocols & allow providers to create a AAA
based infrastructure, it that is what they want.  There
are lots of issues to tackle in this area, but most
get into deployment-type scenarios & I'd prefer to leave
them as deployment issues.  As long as there are the
right 'hooks' then that might be enough.

John